How do I fix `Provisioning profile doesn't include entitlements` for a fastlane deployment with multiple targets

Question

I have an app, with some additional targets (e.g. Siri, Widgets, push etc). My fastlane deploy step looks like this:

lane :build do |options|
    match(
      app_identifier: [
         ENV['IOS_APP_ID'], 
         ENV['SIRI_BUNDLE_ID'], 
         ENV['PUSH_INTERCEPTOR_BUNDLE_ID'], 
         ENV['WIDGETS_BUNDLE_ID']
      ],
      shallow_clone: true,
      clone_branch_directly: true,
      readonly: true
    )

    ios_targets.each do |id, meta|
      profile_env_name = "sigh_#{id}_#{ENV['MATCH_TYPE']}_profile-name"
      profile_path_env_name = "sigh_#{id}_#{ENV['MATCH_TYPE']}_profile-path"
      install_provisioning_profile(
        path: ENV[profile_path_env_name]
      )
      update_project_provisioning(
        xcodeproj: xcodeproj,
        profile: ENV[profile_path_env_name], 
        target_filter: meta[:name],
        build_configuration: ENV['BUILD_CONFIGURATION']
      )
    end

    update_code_signing_settings(
      use_automatic_signing: false,
      path: xcodeproj,
      targets: ios_target_names
    )

    gymOptions = ({
      silent: true,
      export_team_id: ENV['IOS_TEAM_ID'],
      export_options: {
        signingStyle: "manual",
        provisioningProfiles: { 
          ENV['IOS_APP_ID'] => "match AdHoc #{ENV['IOS_APP_ID']}",                                                   
          ENV['SIRI_BUNDLE_ID'] => "match AdHoc #{ENV['SIRI_BUNDLE_ID']}",
          ENV['PUSH_INTERCEPTOR_BUNDLE_ID'] => "match AdHoc #{ENV['PUSH_INTERCEPTOR_BUNDLE_ID']}",
          ENV['WIDGETS_BUNDLE_ID'] => "match AdHoc #{ENV['WIDGETS_BUNDLE_ID']}"
        }
      }
    }).merge(
      File.directory?("../#{xcworkspace}") ?
        {workspace: xcworkspace} :
        {project: xcodeproj}
    )
    gym(gymOptions)

This runs fine. However during the archive phase I get this error

Provisioning profile "match AdHoc com.company.app.Widgets" doesn't include the aps-environment, com.apple.developer.applesignin, com.apple.developer.associated-domains, and com.apple.developer.siri entitlements and doesn't match the entitlements file's value for the application-identifier entitlement."

My WidgetsExtension.entitlements looks like this (i.e. doesn't contain any of the above entitlements):

<dict>
    <key>com.apple.security.application-groups</key>
    <array>
        <string>group.com.company.app</string>
    </array>
</dict>
</plist>

If I log into Apple developer, my match Widget provisioning profile has the same entitlements as my existing one which has been working fine outside of fastlane:

To me this error looks like it is expecting the Widgets to have the same entitlements as the main app, which must surely be a misconfiguration somewhere? Any ideas?